C:\veryfast\AppStore\AppStoreUpdater\Release\auto_updater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa.exe
Resource
win10v2004-20240226-en
General
-
Target
85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa
-
Size
419KB
-
MD5
37d60818a9e18e6c1c06ad1df798d362
-
SHA1
6660e1be4fcf6d2430fee1b703c5494266665bb4
-
SHA256
85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa
-
SHA512
660c42bffdeb9f2ba450918b5fbf77e0ac2af414bdaffe2abe9e25b39e6fba4129dd9cbe901b4740143f2a70b357cd8830f99d0b7bf457f85a48f62ffa0a988a
-
SSDEEP
6144:/85cvHxlYmO5XL2SC/pa97qWhuNhdWLluNxnv2gaFCjAO/4IOuT3:/85cvH0bXL2SC/paNqWW/QFCjZ4oT3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa
Files
-
85371bb9f05bff918d98e0de2330ef7f8cf0da86bd9bb9c96a59173948f606aa.exe windows:6 windows x86 arch:x86
4ff9125edc1b6b0b0dcc22e0fb9bc5c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLastError
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
CreateDirectoryW
MultiByteToWideChar
GetCommandLineW
FindNextFileW
FindClose
OpenEventW
CreateEventW
DeleteFileW
WideCharToMultiByte
GetTickCount
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
HeapSize
InitializeCriticalSectionEx
HeapFree
FindFirstFileW
SizeofResource
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetFileSizeEx
SetFilePointerEx
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
user32
wsprintfW
advapi32
RegOpenKeyExW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
shell32
CommandLineToArgvW
ShellExecuteW
ole32
CoUninitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
oleaut32
VariantClear
SysFreeString
SysAllocString
urlmon
URLDownloadToFileW
rpcrt4
UuidCreate
RpcStringFreeW
UuidToStringW
Sections
.text Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ